Privacy Policy

SOAP (“we,” “our,” “us”) is committed to protecting the privacy of therapists, clinicians, and their clients. We apply the privacy law of the place where you practice. In Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws in Canada. In the United States, we apply the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy law. This Privacy Policy explains how we collect, use, store, and safeguard personal information when you use our platform.

1. Information We Collect

When you use Soap Notes, we may collect the following types of information:

• Account Information: Name, email address, login credentials.
• Professional Information: Practice details, business information, and payment details.
• Client Data: Notes, invoices, session details, and related records that you input into the platform.
• Usage Data: Technical information such as IP address, browser type, and interaction with our platform.
• Google Account Data: If you sign in with Google or connect Gmail, Google Calendar, or Google Meet, the data described in Section 7.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve our services.
• Allow therapists and clinicians to manage invoices, session notes, and client records.
• Process payments and send billing notifications.
• Communicate with you regarding updates, support, or service changes.
• Ensure security, prevent fraud, and comply with legal obligations.

3. How we handle personal information

As required under PIPEDA in Canada, and consistent with HIPAA and applicable state privacy law in the United States:

• We only collect, use, and disclose personal information with knowledge and consent, except where otherwise permitted by law.
• We limit collection to what is necessary for the purposes identified in this Privacy Policy.
• We safeguard personal information with appropriate technical, administrative, and physical security measures.
• We ensure accuracy and allow individuals to access, correct, or withdraw consent regarding their personal information.
• We are accountable for personal information in our control, including information transferred to third-party service providers.

4. Data Storage & Security

• All data is stored securely using encryption and industry-standard safeguards.
• Access to client data is restricted to authorized users only.
• We do not sell, rent, or trade personal information to third parties.

5. Where Your Data Is Stored

• Client records are stored in the United States on Amazon Web Services (us-east-1) through Supabase, our database provider.
• Data is encrypted in transit and at rest.
• Encrypted backups are kept with Cloudflare.
• If you practice outside the United States, including in Canada, you consent to the storage and processing of your information, and your clients’ information, in the United States by using the service.

The service providers that store or process data on our behalf are listed on ourSecurity page.

6. Sharing of Information

We may share information only in the following cases:

• With service providers who support our platform (e.g., secure hosting, payment processors).
• When required by law or legal process.
• With your explicit consent.

6.1 Third-Party Integrations

Soap Notes integrates with select third-party services to enhance functionality, such as scheduling and communication. These integrations use secure OAuth or API connections, and we only share necessary information with your explicit consent during setup. Data is used only for the integration's purpose. Where an integration stores data in Soap Notes, the description below says so. Below are our current integrations:

• Zoom: Used for creating and scheduling virtual sessions. We request access to your Zoom profile (name, email) for personalization and meeting creation (topics, times, join links). This data is used in real-time to generate links and is not stored long-term or shared externally. Tokens are encrypted and deleted upon disconnection.
• Google: For sign-in, Gmail, Google Calendar, and Google Meet. Section 7 sets out exactly what Soap Notes accesses for each service, what it stores, and how to remove it.
• Calendly: For automated booking. We connect to pull availability and create events, sharing only scheduling details (e.g., time slots) without sensitive client notes.
• Klaviyo: For email notifications and marketing. We share contact info (email) for billing reminders or updates, with opt-out options at any time. No session or client data is included.

For all integrations, consent is obtained during authorization, and you can revoke access via Soap Notes settings or the providers dashboard. See Section 8 for exercising rights over this data.

7. Google User Data

This section covers the data Soap Notes receives from Google when you sign in with Google, or when you connect a Google service under Settings > Integrations or Settings > Emails. Soap Notes asks for a Google permission only when you connect the service that needs it, and Google shows you each permission on its consent screen before you approve it. You can connect one service without the others.

7.1 Data Soap Notes accesses

Sign in with Google (openid, email, profile). Soap Notes receives your name, email address, and profile picture from your Google Account and uses them to create your account and sign you in. These same basic permissions are also requested when you connect any of the services below, so Soap Notes can tell which Google Account you connected.

Gmail (gmail.send, gmail.readonly). Soap Notes uses gmail.send only when you choose a connected Gmail address as the sender of an invoice, a client email, an automated email, or a client portal link. The email is sent from that address to the recipients you chose and appears in its Gmail Sent folder. Soap Notes uses gmail.readonly to show your email history with a client on that client's profile. When you open a client's emails, Soap Notes searches your mailbox only for messages sent from, to, or copied to that client's email addresses, and copies the most recent matching messages (up to 25 per mailbox per sync) into the client's record. For each message it stores the sender, recipients, subject, date, message body, and the names and sizes of attachments. Attachment files are fetched from Gmail only when you open them. Soap Notes does not read, store, or index messages that don't involve one of your clients' email addresses. If your organization connects a shared sending mailbox under Settings > Emails, the same applies to that mailbox.

Google Calendar (calendar.readonly, calendar.events). Soap Notes uses calendar.events to add a session to the calendar you choose when it is booked, update the event when a session is rescheduled, and delete it when a session is cancelled. The event includes the session time and details, a Google Meet link if you chose Meet as the conference app, and the client as a guest if you chose to send a calendar invite. Soap Notes uses calendar.readonly to list your calendars so you can pick which ones to check for conflicts, and to read free/busy times from those calendars so clients can't book a time when you are already busy. Free/busy information contains start and end times only, not event titles, descriptions, or guests. Soap Notes stores the IDs and names of the calendars you select and the IDs of the events it created.

Google Meet (meetings.space.readonly, documents.readonly, plus the Google Calendar permissions above). If you use Gemini's "Take notes for me" in Google Meet, Soap Notes brings those notes onto your session page. After a meeting you organized ends, Soap Notes reads the meeting record (title, start and end time, meeting code, and participants), the Gemini notes, and the transcript, and matches the meeting to a session by its meeting link. It uses documents.readonly only to read the notes and transcript documents Google Meet created for those meetings. Soap Notes stores the notes summary, action items, transcript text, participant list, host email address, and links to the Google Docs. Nothing is added to a session note until you insert it. The original notes stay in your Google Docs, and Soap Notes never edits or deletes them.

7.2 How Soap Notes uses Google user data

• Google user data is used only to provide the features described in Section 7.1 that you turned on, and to keep them secure.
• Google user data is never sold, and never used for advertising, including retargeting, personalized ads, or interest-based ads.
• Google user data is not used to determine credit-worthiness or for lending purposes.
• Soap Notes does not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.
• Soap Notes staff do not read your Google user data unless you give permission for specific messages or documents (for example, when you ask support to look at a problem), it is needed for security purposes such as investigating abuse, it is needed to comply with applicable law, or it has been aggregated and anonymized for internal operations.

7.3 Sharing Google user data

Soap Notes does not transfer Google user data to third parties except: to the service providers that host and back up Soap Notes (listed on our Security page), only as needed to run the features above; when required by applicable law; to protect against fraud, abuse, or security threats; or as part of a merger, acquisition, or sale of assets, after notifying you. Emails Soap Notes sends for you through Gmail go to the recipients you chose.

7.4 Limited Use disclosure

Soap Notes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.5 Storage and security

Google user data, and the OAuth access and refresh tokens Google issues when you connect a service, are stored in the Soap Notes database described in Section 5, encrypted in transit and at rest. This data is available only inside your organization's Soap Notes account.

7.6 Retention, deletion, and revoking access

• Google OAuth tokens are kept while a service is connected. When you disconnect a Google service in Settings > Integrations or Settings > Emails, Soap Notes deletes the tokens for that service and stops accessing it.
• Emails and Google Meet notes already copied into a client or session record stay there after you disconnect, as part of that record, until you delete them or your account is deleted. To request their deletion sooner, email privacy@soapnotes.online.
• When your organization's Soap Notes account is deleted, the Google user data and tokens stored for it are deleted too.
• Calendar events and emails Soap Notes created belong to your Google Account and stay there after you disconnect. You can manage them in Google Calendar and Gmail.
• You can revoke Soap Notes' access to your Google Account at any time from your Google Account permissions page. After you revoke access, Soap Notes can no longer read or send anything through your Google Account.

8. Your Rights

In line with PIPEDA in Canada, and with HIPAA and applicable state privacy law in the United States, you have the right to:

• Access and update your personal information.
• Request correction of inaccurate information.
• Withdraw consent for the use or disclosure of your information, subject to legal or contractual restrictions.
• Request deletion of your data (where legally permitted).

9. Data Retention

We retain data only as long as necessary to provide our services or comply with legal obligations. Therapists and clinicians may manage or delete their records at their discretion. Retention and deletion of data received from Google is covered in Section 7.6.

10. Cookies & Analytics

We use cookies and similar technologies to operate our website and understand how visitors interact with Soap Notes.

We use trusted third-party analytics providers, including PostHog and Google Analytics, to help us understand website and product usage, improve our services, and measure the effectiveness of our marketing. These providers are based in the United States, and information may be processed there.

Analytics information may include information such as pages visited, interactions with our website or app, device and browser information, and general location information.

We do not use analytics tools to collect or analyse the contents of your session notes, client records, invoices, or other sensitive information you enter into Soap Notes.

You can manage or delete cookies through your browser settings. Some cookies may be necessary for certain features of our services to function properly.

11. Children’s Privacy

Soap Notes is intended for licensed professionals. We do not knowingly collect personal information directly from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted here with an updated “Last Updated” date.

13. Contact Us

If you have any questions about this Privacy Policy, or about how we handle personal information, pleaseContact us

• Privacy Officer: Michael Wong
• Email: privacy@soapnotes.online
• Business Address: 390 Cherry St, Toronto, Ontario